EP0720796A1 - System and method for changing the key or password in a secure distributed communications network - Google Patents
System and method for changing the key or password in a secure distributed communications networkInfo
- Publication number
- EP0720796A1 EP0720796A1 EP93920773A EP93920773A EP0720796A1 EP 0720796 A1 EP0720796 A1 EP 0720796A1 EP 93920773 A EP93920773 A EP 93920773A EP 93920773 A EP93920773 A EP 93920773A EP 0720796 A1 EP0720796 A1 EP 0720796A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- key
- knew
- kold
- user
- server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
Definitions
- passwords or keys are necessary to communicate safely between users, or between users and servers for accessing application programs or other purposes, including confidentiality, integrity, and authentication. It should be noted that authentication is also necessary for servers, i.e. even servers need to prove their identity to prevent an intruder from masquerading as a server.
- Kerberos A well-known solution for network-wide log-in is part of the "Kerberos" system, originated at the Massachussetts Institute of Technology (MIT), and described in [1 ].
- the Kerberos system includes a change-password protocol which avoids openly transmitting the new and old passwords over the communication line. This protocol is depicted in Fig. 1.
- Kerberos change -password protocol has some shortcomings, notably:
- a so-called Trojan Horse program could create an additional message changing the password to a third value unknown to the user but known to an intruder controlling the Trojan Horse.
- a "ticket" is an encrypted message containing a secret key to be used to authenticate to a service.
- this is named the Trojan Horse attack.
- Kerberos function is not generalized to be used also for the renewal of "strong" keys between the authentication server and application servers.
- the present invention overcomes the above shortcomings of the known systems by providing a secure and compact authentication protocol between a user and the authentication server without sacrificing any of the important advantages of the known systems. According to the invention, just two messages need to be exchanged and a simple, straightforward error recovery is provided.
- the protocol is secure against Trojan Horse and walk-by attacks and can be used to change passwords and cryptographic keys.
- the invention as claimed is a method for providing exchange of a new password or key in a communication network with one or more users and at least one authentication server, wherein the user first requests a key change by transmitting a specific message to the server.
- This first message has at least information on freshness, the user's name or identifier, a ticket encrypting the selected new key under the present key, and a ticket encrypting the present key under the new key.
- the server identifies the user, determines the new key by employing the stored present key of said user, determines a potential present key and compares the latter with the actual present key, and, depending on the result of said comparison and some further conditions, (i.e.
- This second message contains at least an accept/reject message, and an encryption of the received change key request under the present key.
- Errors are recovered by simply resending the first message from the user, of course with newly adapted freshness information, and performing the same method steps again.
- the protocol is based on a single and atomic challenge/response exchange.
- the possibility of idempotent re-tries provides for a level of robustness and security that is not possible with current protocols.
- the protocol messages are not re-playable in the sense that a replay cannot have harmful effects, i.e. would be received unnoticed. This feature is due to the asymmetric property of the tickets in the password change request.
- the protocol offers protection against walk-by-attacks and Trojan Horse programs.
- Partial protection against replay of re-used keys is provided by using a timestamp as one of the two nonces in the ticket construction.
- the protocol can be resumed after a system crash either on the side of the authentication server or the requesting principal.
- Fig. 1 shows a flow chart of the prior art Kerberos protocol for changing keys or passwords between a user (or application server) and the authentication server;
- Fig. 2 is a logical flow chart of the key change protocol according to the invention;
- Fig. 3 depicts a basic layout of a communication network in which the invention can be used.
- ADMIN administration server (separate process co-located with the AS)
- N1 , N2 nonces
- the present change-password (CPW) protocol is used to change the user's password or an application server's master-key, as stored in the registry or principal data base (PDB) at the authentication server.
- PDB principal data base
- the invention addresses the following requirements:
- the CPW request should contain an authentication of the sender.
- this involves providing the old password or key again to prevent password changes from unattended workstations on which a user is logged on. but presently absent.
- the CPW request must be self-checking, i.e. the AS must be able to find out whether the new key (Knew) it extracted is the right one, in other words, that the message was not corrupted.
- the AS has to confirm the state of the password change (success or failure) to the principal.
- the acknowledgement itself must be authenticated and can be issued repeatedly for the re-transmissions of the CPW request message.
- Knew The principal does not change the value of the new key (Knew) until successful validation of the CPW request. Knew is also not installed if a negative acknowledgement, rejecting Knew, is sent. A reason can be that the new key is poorly chosen, e.g. the user's full name.
- the AS is "single-state" with respect to a given principal. In other words, it may but need not remember more than one key per principal (i.e. it does not have to keep any key history).
- the AS has a fairly accurate clock. Fairly accurate means that it is accurate with respect to the frequency of CPWs which happen infrequently, i.e., daily, weekly or monthly, but not every minute or hour.
- Each host or workstation (where CPW requests originate) also possesses a fairly accurate clock. However, that clock need not be tightly synchronized with the AS clock.
- the requesting machine's file system allows any process with the user's identification to read a cached single-sign-on key, Ksso.
- Ksso is a strong session key established between the user's processes and the AS during initial login. It is used to access other services without having to provide a password every time.
- the basic idea of the invention is to construct an idempotent "flip-flop" request. After a first CPW request without successful receipt of an acknowledgement, the principal must simply retransmit his request.
- the authentication server, AS knows in this case either the present key, Kold, or the new key, Knew, depending on whether the CPW request or the acknowledgement got lost, but the flip-flop property of the request enables it to process the request message correctly in either state:
- the AS As soon as the AS receives an authentic CPW request, it processes it and replies with an acknowledgement. If the AS receives an authentic request again from the same sender, obviously the acknowledgement must have been lost, thus the principal data base, PDB, in the AS is left untouched and another acknowledgement is issued.
- the function "g” provides for asymmetry between the two tickets in such a way that an intruder cannot swap the two tickets and thereby convince a server to switch back to the old key.
- "g” must be asymmetric, otherwise manipulation of the plaintext N2 (e.g. reciprocal value or XOR with N 1 ) would re-enable the above swapping attack.
- the function "g” could depend on the single-sign-on key, Ksso. This requires that a user is prohibited from logoff until the CPW protocol is completed, because a logoff clears Ksso.
- the first nonce, N 1 is preferably set to the current time.
- the second nonce, N2 is chosen at random.
- the setting of N1 does not require synchronized clocks because the skews of the workstation clocks are generally much smaller than the frequency of key changes. If an intruder should set a workstation's clock to some random time in the future, the authentication server, AS. would still reject this challenge because of wrong time. The intruder could replay it at that time with the assumption that the principal by then just re-used the very same old key, Kold. However, this is considered highly improbable. (It is later referred to as "partial pw-cycle prevention".) With this choice of the nonces, two items provide for synchronization: Kold and the "timestamp" N 1 .
- the acknowledgement has the following form:
- REP_CPW ⁇ accept/reject, REQ_CPW ⁇ Kold
- This acknowledgement securely ties the accept/reject reply to the proper request.
- An incorrect or malformed REQ_CPW is one where:
- the timestamp represented by N1 is unacceptable, i.e., outside the limits of the acceptable clock skew.
- REQ_CPWs which do not satify the "flip-flop" property are not acknowledged in the same manner. Any kind of authenticated acknowledgment in response to such an REQ_CPW is out of question, because doing so would require using the principal's current stored key. This would present an opportunity for a known plaintext or dictionary attack, cf. reference [2]. Therefore, the mechanism on the user's side must at least provide for an error message which, after a certain number of unanswered REQ_CPWs, i.e. a CPW request timeout, checks for the general availability of the AS and suggests resorting to off-line means for re-synchronization.
- the acknowledgment message, REP_CPW must also be protected. If not, an intruder could trap the original REQ_CPW, prevent it from reaching the AS and convince the principal that the change has taken place.
- the key used to protect REP_CPW can be any of Knew, Kold or Ksso.
- Knew Knew
- Kold Ksso
- a problem with using Knew is, when the AS rejects Knew for some reason (e.g. weak key), the reply must still be authentic. In this case, Kold must be used . Alternatively, for the sake of uniformity, Kold can be used in both cases (i.e. success or failure).
- the self checking "flip-flop" feature allows for an off-line key-search attack. This attack is possible because the very same structure of REQ_CPW that allows the AS to verify Knew and Kold allows the intruder to verify his guesses by iterating through the key space.
- FIG. 3 shows a communication network, sketchy, but in sufficient detail to explain an embodiment of the invention in hardware terms.
- the system provides the desired secure communication between users or between a user and an application server.
- the drawing shows the basic layout of a system with a user workstation 1 having encryption/decription means (E/D) 2 and a clock 3.
- Workstation 1 is connected to a network 4 of arbitrary form and layout.
- an authentication server 5 which also includes encryption/decriptions means (E/D) 6 and a clock 7.
- Authentication server 5 includes and/or has access to a principal data base (PDB) 8.
- PDB principal data base
- principal data base 8 has the old user key (Kold) stored.
- a (human) user accesses workstation 1 , desiring to change of his/her password or key.
- An example would be a bank client at an automatic teller machine, desiring to change his/her personal identification number, usually termed PIN, for his/her credit/bank card.
- PIN personal identification number
- the user enters, preferably guided by specific questions from the automatic teller, his/her old key (Kold) as identity information and the desired new key (Knew).
- Workstation 1 i.e. the automatic teller machine, encrypts by its E/D means 2 the entered identity information, i.e.
- the encrypted message including an appropriate key change command, is sent over network 4 to authentication server 5.
- the received message is interpreted whereby E/D means 6 decrypts the information contained in the message.
- the transmitted (and decrypted) freshness information i.e. the workstation clock time, is compared with the time that server clock 7 shows and it is determined whether the (usually existing) time difference is within prescribed limits.
- the transmitted (and decripted) identity information i.e. the old key (Kold) is compared with the stored key contained in principal data base 8.
- the desired new key (Knew) is investigated whether it is acceptable or not, i .e. whether it satisfies prescribed requirements.
- server 5 replies to workstation 1 with a message indicating rejection of the key change request.
Abstract
Description
Claims
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/EP1993/002540 WO1995008885A1 (en) | 1993-09-20 | 1993-09-20 | System and method for changing the key or password in a secure distributed communications network |
US08/598,481 US5778065A (en) | 1993-09-20 | 1996-02-08 | Method and system for changing an authorization password or key in a distributed communication network |
Publications (2)
Publication Number | Publication Date |
---|---|
EP0720796A1 true EP0720796A1 (en) | 1996-07-10 |
EP0720796B1 EP0720796B1 (en) | 1997-07-16 |
Family
ID=26070064
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP93920773A Expired - Lifetime EP0720796B1 (en) | 1993-09-20 | 1993-09-20 | System and method for changing the key or password in a secure distributed communications network |
Country Status (5)
Country | Link |
---|---|
US (1) | US5778065A (en) |
EP (1) | EP0720796B1 (en) |
JP (1) | JP2828218B2 (en) |
DE (1) | DE69312328T2 (en) |
WO (1) | WO1995008885A1 (en) |
Families Citing this family (110)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5708710A (en) * | 1995-06-23 | 1998-01-13 | Motorola, Inc. | Method and apparatus for authentication in a communication system |
US5734718A (en) * | 1995-07-05 | 1998-03-31 | Sun Microsystems, Inc. | NIS+ password update protocol |
AU3214697A (en) * | 1996-06-03 | 1998-01-05 | Electronic Data Systems Corporation | Automated password reset |
DE19622630C1 (en) * | 1996-06-05 | 1997-11-20 | Siemens Ag | Method for group-based cryptographic key management between a first computer unit and group computer units |
JP4272714B2 (en) * | 1996-07-19 | 2009-06-03 | キヤノン株式会社 | Image recording apparatus and image recording method |
US6275941B1 (en) * | 1997-03-28 | 2001-08-14 | Hiatchi, Ltd. | Security management method for network system |
US6070243A (en) * | 1997-06-13 | 2000-05-30 | Xylan Corporation | Deterministic user authentication service for communication network |
IL122106A (en) * | 1997-11-04 | 2010-11-30 | Enco Tone Ltd | Method and algorithms for identification and validation |
KR19990041740A (en) * | 1997-11-24 | 1999-06-15 | 구자홍 | Personal information input device and method of home banking system |
US6263446B1 (en) * | 1997-12-23 | 2001-07-17 | Arcot Systems, Inc. | Method and apparatus for secure distribution of authentication credentials to roaming users |
US7328350B2 (en) * | 2001-03-29 | 2008-02-05 | Arcot Systems, Inc. | Method and apparatus for secure cryptographic key generation, certification and use |
US6151676A (en) * | 1997-12-24 | 2000-11-21 | Philips Electronics North America Corporation | Administration and utilization of secret fresh random numbers in a networked environment |
US7587044B2 (en) | 1998-01-02 | 2009-09-08 | Cryptography Research, Inc. | Differential power analysis method and apparatus |
WO1999035782A1 (en) * | 1998-01-02 | 1999-07-15 | Cryptography Research, Inc. | Leak-resistant cryptographic method and apparatus |
US6088805A (en) * | 1998-02-13 | 2000-07-11 | International Business Machines Corporation | Systems, methods and computer program products for authenticating client requests with client certificate information |
CA2333095C (en) * | 1998-06-03 | 2005-05-10 | Cryptography Research, Inc. | Improved des and other cryptographic processes with leak minimization for smartcards and other cryptosystems |
DE69935913T2 (en) | 1998-07-02 | 2008-01-10 | Cryptography Research Inc., San Francisco | LACK RESISTANT UPGRADE OF AN INDEXED CRYPTOGRAPHIC KEY |
AU1631200A (en) * | 1998-11-19 | 2000-06-05 | Arcot Systems, Inc. | Method and apparatus for secure distribution of authentication credentials to roaming users |
US6510236B1 (en) | 1998-12-11 | 2003-01-21 | International Business Machines Corporation | Authentication framework for managing authentication requests from multiple authentication devices |
FR2789536B1 (en) * | 1999-02-08 | 2001-03-09 | Bull Sa | DEVICE AND METHOD FOR AUTHENTICATING A REMOTE USER |
US6424953B1 (en) * | 1999-03-19 | 2002-07-23 | Compaq Computer Corp. | Encrypting secrets in a file for an electronic micro-commerce system |
US7257554B1 (en) | 1999-03-19 | 2007-08-14 | Hewlett-Packard Development Company, L.P. | Anonymous purchases while allowing verifiable identities for refunds returned along the paths taken to make the purchases |
US6892308B1 (en) * | 1999-04-09 | 2005-05-10 | General Instrument Corporation | Internet protocol telephony security architecture |
AU4079200A (en) * | 1999-04-09 | 2000-11-14 | General Instrument Corporation | Built-in manufacturer's certificates for a cable telephony adapter to provide device and service certification |
US6584505B1 (en) * | 1999-07-08 | 2003-06-24 | Microsoft Corporation | Authenticating access to a network server without communicating login information through the network server |
US6678731B1 (en) * | 1999-07-08 | 2004-01-13 | Microsoft Corporation | Controlling access to a network server using an authentication ticket |
US6915431B1 (en) * | 1999-12-22 | 2005-07-05 | Intel Corporation | System and method for providing security mechanisms for securing network communication |
EP2278538A1 (en) * | 2000-04-24 | 2011-01-26 | Visa International Service Association | Online payer authentication service |
US7373507B2 (en) * | 2000-08-10 | 2008-05-13 | Plethora Technology, Inc. | System and method for establishing secure communication |
US7107051B1 (en) * | 2000-09-28 | 2006-09-12 | Intel Corporation | Technique to establish wireless session keys suitable for roaming |
FI111423B (en) * | 2000-11-28 | 2003-07-15 | Nokia Corp | A system for securing post-handover communications |
FI115098B (en) * | 2000-12-27 | 2005-02-28 | Nokia Corp | Authentication in data communication |
US8069116B2 (en) * | 2001-01-17 | 2011-11-29 | Contentguard Holdings, Inc. | System and method for supplying and managing usage rights associated with an item repository |
US20020122553A1 (en) * | 2001-03-01 | 2002-09-05 | International Business Machines Corporation | Method and apparatus for lightweight rekeying of a master key in a single sign-on system |
US20020129285A1 (en) * | 2001-03-08 | 2002-09-12 | Masateru Kuwata | Biometric authenticated VLAN |
US7203837B2 (en) | 2001-04-12 | 2007-04-10 | Microsoft Corporation | Methods and systems for unilateral authentication of messages |
US7428749B2 (en) * | 2001-08-03 | 2008-09-23 | International Business Machines Corporation | Secure delegation using public key authorization |
US7249261B2 (en) * | 2001-10-16 | 2007-07-24 | Activcard Ireland Limited | Method for securely supporting password change |
US7478418B2 (en) | 2001-12-12 | 2009-01-13 | Guardian Data Storage, Llc | Guaranteed delivery of changes to security policies in a distributed system |
US7921450B1 (en) | 2001-12-12 | 2011-04-05 | Klimenty Vainstein | Security system using indirect key generation from access rules and methods therefor |
US7783765B2 (en) * | 2001-12-12 | 2010-08-24 | Hildebrand Hal S | System and method for providing distributed access control to secured documents |
US7562232B2 (en) | 2001-12-12 | 2009-07-14 | Patrick Zuili | System and method for providing manageability to security information for secured items |
US7681034B1 (en) | 2001-12-12 | 2010-03-16 | Chang-Ping Lee | Method and apparatus for securing electronic data |
US8006280B1 (en) | 2001-12-12 | 2011-08-23 | Hildebrand Hal S | Security system for generating keys from access rules in a decentralized manner and methods therefor |
US7921284B1 (en) | 2001-12-12 | 2011-04-05 | Gary Mark Kinghorn | Method and system for protecting electronic data in enterprise environment |
US7930756B1 (en) | 2001-12-12 | 2011-04-19 | Crocker Steven Toye | Multi-level cryptographic transformations for securing digital assets |
US10360545B2 (en) | 2001-12-12 | 2019-07-23 | Guardian Data Storage, Llc | Method and apparatus for accessing secured electronic data off-line |
USRE41546E1 (en) | 2001-12-12 | 2010-08-17 | Klimenty Vainstein | Method and system for managing security tiers |
US7380120B1 (en) | 2001-12-12 | 2008-05-27 | Guardian Data Storage, Llc | Secured data format for access control |
US7631184B2 (en) | 2002-05-14 | 2009-12-08 | Nicholas Ryan | System and method for imposing security on copies of secured items |
US7178033B1 (en) | 2001-12-12 | 2007-02-13 | Pss Systems, Inc. | Method and apparatus for securing digital assets |
US8065713B1 (en) | 2001-12-12 | 2011-11-22 | Klimenty Vainstein | System and method for providing multi-location access management to secured items |
US7565683B1 (en) | 2001-12-12 | 2009-07-21 | Weiqing Huang | Method and system for implementing changes to security policies in a distributed security system |
US10033700B2 (en) | 2001-12-12 | 2018-07-24 | Intellectual Ventures I Llc | Dynamic evaluation of access rights |
US7260555B2 (en) | 2001-12-12 | 2007-08-21 | Guardian Data Storage, Llc | Method and architecture for providing pervasive security to digital assets |
US7921288B1 (en) | 2001-12-12 | 2011-04-05 | Hildebrand Hal S | System and method for providing different levels of key security for controlling access to secured items |
US7950066B1 (en) | 2001-12-21 | 2011-05-24 | Guardian Data Storage, Llc | Method and system for restricting use of a clipboard application |
US8176334B2 (en) | 2002-09-30 | 2012-05-08 | Guardian Data Storage, Llc | Document security system that permits external users to gain access to secured files |
US7477748B2 (en) * | 2002-03-18 | 2009-01-13 | Colin Martin Schmidt | Session key distribution methods using a hierarchy of key servers |
US7707120B2 (en) | 2002-04-17 | 2010-04-27 | Visa International Service Association | Mobile account authentication service |
US8613102B2 (en) | 2004-03-30 | 2013-12-17 | Intellectual Ventures I Llc | Method and system for providing document retention using cryptography |
US20030204724A1 (en) * | 2002-04-30 | 2003-10-30 | Microsoft Corporation | Methods for remotely changing a communications password |
US7523490B2 (en) * | 2002-05-15 | 2009-04-21 | Microsoft Corporation | Session key security protocol |
US7370194B2 (en) * | 2002-06-10 | 2008-05-06 | Microsoft Corporation | Security gateway for online console-based gaming |
US7565537B2 (en) * | 2002-06-10 | 2009-07-21 | Microsoft Corporation | Secure key exchange with mutual authentication |
US20040009815A1 (en) * | 2002-06-26 | 2004-01-15 | Zotto Banjamin O. | Managing access to content |
US7370197B2 (en) * | 2002-07-12 | 2008-05-06 | Microsoft Corporation | Method and system for authenticating messages |
US7725730B2 (en) * | 2002-08-09 | 2010-05-25 | Emc Corporation | Cryptographic methods and apparatus for secure authentication |
SG152061A1 (en) * | 2002-09-10 | 2009-05-29 | Visa Int Service Ass | Data authentication and provisioning method and system |
US7512810B1 (en) | 2002-09-11 | 2009-03-31 | Guardian Data Storage Llc | Method and system for protecting encrypted files transmitted over a network |
US7266201B1 (en) * | 2002-09-17 | 2007-09-04 | Foundry Networks, Inc. | Non-disruptive authentication administration |
US20040064725A1 (en) * | 2002-09-18 | 2004-04-01 | Microsoft Corporation | Method and system for detecting a communication problem in a computer network |
AU2003292300A1 (en) * | 2002-10-30 | 2004-06-07 | Thomson Licensing S.A. | Simplified method for renewing symmetrical keys in a digital network |
US7836310B1 (en) * | 2002-11-01 | 2010-11-16 | Yevgeniy Gutnik | Security system that uses indirect password-based encryption |
WO2004043037A1 (en) * | 2002-11-06 | 2004-05-21 | International Business Machines Corporation | Providing a user device with a set of access codes |
US7577838B1 (en) | 2002-12-20 | 2009-08-18 | Alain Rossmann | Hybrid systems for securing digital assets |
US7890990B1 (en) | 2002-12-20 | 2011-02-15 | Klimenty Vainstein | Security system with staging capabilities |
US7409544B2 (en) | 2003-03-27 | 2008-08-05 | Microsoft Corporation | Methods and systems for authenticating messages |
US7610487B2 (en) | 2003-03-27 | 2009-10-27 | Microsoft Corporation | Human input security codes |
US7624264B2 (en) | 2003-03-27 | 2009-11-24 | Microsoft Corporation | Using time to determine a hash extension |
US8261062B2 (en) * | 2003-03-27 | 2012-09-04 | Microsoft Corporation | Non-cryptographic addressing |
EP1618701B1 (en) * | 2003-04-16 | 2011-01-05 | TELEFONAKTIEBOLAGET LM ERICSSON (publ) | Authentication method |
US7344882B2 (en) * | 2003-05-12 | 2008-03-18 | Bristol-Myers Squibb Company | Polynucleotides encoding variants of the TRP channel family member, LTRPC3 |
US8707034B1 (en) | 2003-05-30 | 2014-04-22 | Intellectual Ventures I Llc | Method and system for using remote headers to secure electronic files |
US7555558B1 (en) | 2003-08-15 | 2009-06-30 | Michael Frederick Kenrich | Method and system for fault-tolerant transfer of files across a network |
US8127366B2 (en) | 2003-09-30 | 2012-02-28 | Guardian Data Storage, Llc | Method and apparatus for transitioning between states of security policies used to secure electronic documents |
US7703140B2 (en) | 2003-09-30 | 2010-04-20 | Guardian Data Storage, Llc | Method and system for securing digital assets using process-driven security policies |
US7734929B2 (en) * | 2004-04-30 | 2010-06-08 | Hewlett-Packard Development Company, L.P. | Authorization method |
US8762283B2 (en) | 2004-05-03 | 2014-06-24 | Visa International Service Association | Multiple party benefit from an online authentication service |
US7929689B2 (en) * | 2004-06-30 | 2011-04-19 | Microsoft Corporation | Call signs |
US7707427B1 (en) | 2004-07-19 | 2010-04-27 | Michael Frederick Kenrich | Multi-level file digests |
JP2007034409A (en) * | 2005-07-22 | 2007-02-08 | Oki Electric Ind Co Ltd | Personal identification number alteration system |
CN101310286B (en) * | 2005-11-24 | 2011-12-14 | 国际商业机器公司 | Improved single sign on |
US8086842B2 (en) * | 2006-04-21 | 2011-12-27 | Microsoft Corporation | Peer-to-peer contact exchange |
US8059819B2 (en) | 2007-01-17 | 2011-11-15 | Panasonic Electric Works Co., Ltd. | Systems and methods for distributing updates for a key at a maximum rekey rate |
US8588420B2 (en) | 2007-01-18 | 2013-11-19 | Panasonic Corporation | Systems and methods for determining a time delay for sending a key update request |
KR100879540B1 (en) | 2007-03-28 | 2009-01-22 | 삼성전자주식회사 | Method and System for updating security key in DMU |
US8219494B1 (en) * | 2007-08-16 | 2012-07-10 | Corbis Corporation | End-to-end licensing of digital media assets |
US9449346B1 (en) | 2014-05-21 | 2016-09-20 | Plaid Technologies, Inc. | System and method for programmatically accessing financial data |
US9595023B1 (en) | 2014-05-21 | 2017-03-14 | Plaid Technologies, Inc. | System and method for facilitating programmatic verification of transactions |
US10050789B2 (en) * | 2015-04-24 | 2018-08-14 | Red Hat, Inc. | Kerberos preauthentication with J-PAKE |
AU2016321166B2 (en) | 2015-09-08 | 2021-07-15 | Plaid Inc. | Secure permissioning of access to user accounts, including secure deauthorization of access to user accounts |
US10726491B1 (en) | 2015-12-28 | 2020-07-28 | Plaid Inc. | Parameter-based computer evaluation of user accounts based on user account data stored in one or more databases |
US10984468B1 (en) | 2016-01-06 | 2021-04-20 | Plaid Inc. | Systems and methods for estimating past and prospective attribute values associated with a user account |
US11468085B2 (en) | 2017-07-22 | 2022-10-11 | Plaid Inc. | Browser-based aggregation |
US10878421B2 (en) | 2017-07-22 | 2020-12-29 | Plaid Inc. | Data verified deposits |
US11316862B1 (en) | 2018-09-14 | 2022-04-26 | Plaid Inc. | Secure authorization of access to user accounts by one or more authorization mechanisms |
US11887069B2 (en) | 2020-05-05 | 2024-01-30 | Plaid Inc. | Secure updating of allocations to user accounts |
US11327960B1 (en) | 2020-10-16 | 2022-05-10 | Plaid Inc. | Systems and methods for data parsing |
CN116318685B (en) * | 2023-05-17 | 2023-07-21 | 湖南警察学院 | Data security exchange system of mobile storage equipment |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5224163A (en) * | 1990-09-28 | 1993-06-29 | Digital Equipment Corporation | Method for delegating authorization from one entity to another through the use of session encryption keys |
US5148479A (en) * | 1991-03-20 | 1992-09-15 | International Business Machines Corp. | Authentication protocols in communication networks |
EP0566811A1 (en) * | 1992-04-23 | 1993-10-27 | International Business Machines Corporation | Authentication method and system with a smartcard |
US5418854A (en) * | 1992-04-28 | 1995-05-23 | Digital Equipment Corporation | Method and apparatus for protecting the confidentiality of passwords in a distributed data processing system |
US5369705A (en) * | 1992-06-03 | 1994-11-29 | International Business Machines Corporation | Multi-party secure session/conference |
US5371794A (en) * | 1993-11-02 | 1994-12-06 | Sun Microsystems, Inc. | Method and apparatus for privacy and authentication in wireless networks |
US5491750A (en) * | 1993-12-30 | 1996-02-13 | International Business Machines Corporation | Method and apparatus for three-party entity authentication and key distribution using message authentication codes |
US5629980A (en) * | 1994-11-23 | 1997-05-13 | Xerox Corporation | System for controlling the distribution and use of digital works |
-
1993
- 1993-09-20 DE DE69312328T patent/DE69312328T2/en not_active Expired - Lifetime
- 1993-09-20 WO PCT/EP1993/002540 patent/WO1995008885A1/en active IP Right Grant
- 1993-09-20 JP JP7509510A patent/JP2828218B2/en not_active Expired - Fee Related
- 1993-09-20 EP EP93920773A patent/EP0720796B1/en not_active Expired - Lifetime
-
1996
- 1996-02-08 US US08/598,481 patent/US5778065A/en not_active Expired - Fee Related
Non-Patent Citations (1)
Title |
---|
See references of WO9508885A1 * |
Also Published As
Publication number | Publication date |
---|---|
JP2828218B2 (en) | 1998-11-25 |
EP0720796B1 (en) | 1997-07-16 |
DE69312328T2 (en) | 1998-01-08 |
WO1995008885A1 (en) | 1995-03-30 |
US5778065A (en) | 1998-07-07 |
JPH08510581A (en) | 1996-11-05 |
DE69312328D1 (en) | 1997-08-21 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP0720796B1 (en) | System and method for changing the key or password in a secure distributed communications network | |
US6073237A (en) | Tamper resistant method and apparatus | |
Kehne et al. | A nonce-based protocol for multiple authentications | |
US5442342A (en) | Distributed user authentication protocol | |
US5491752A (en) | System for increasing the difficulty of password guessing attacks in a distributed authentication scheme employing authentication tokens | |
EP1927211B1 (en) | Authentication method and apparatus utilizing proof-of-authentication module | |
US5497421A (en) | Method and apparatus for protecting the confidentiality of passwords in a distributed data processing system | |
EP1277299B1 (en) | Method for securing communications between a terminal and an additional user equipment | |
US8621216B2 (en) | Method, system and device for synchronizing between server and mobile device | |
US20030172272A1 (en) | Authentication system and method | |
US20020062452A1 (en) | Countering credentials copying | |
JPH10336169A (en) | Authenticating method, authenticating device, storage medium, authenticating server and authenticating terminal | |
Lam et al. | Freshness assurance of authentication protocols | |
WO2001013201A2 (en) | Peer-to-peer network user authentication protocol | |
JP2001069138A (en) | User verifying system on internet for shared key enciphered ic card | |
WO2001011817A2 (en) | Network user authentication protocol | |
KR19990038925A (en) | Secure Two-Way Authentication Method in a Distributed Environment | |
Hauser et al. | Robust and secure password and key change method | |
Mishra et al. | Cryptanalysis and Improvement of Jiang et al.'s Smart Card Based Remote User Authentication Scheme | |
Hauser et al. | Robust and secure password and key change method | |
Ku et al. | Cryptanalysis of A One-Time Password Authentication Protocol | |
EP1203479A2 (en) | Peer-to-peer network user authentication protocol | |
EA046054B1 (en) | METHOD FOR AUTHENTICATION OF TYFLOSPLAYER IN THE ONLINE LIBRARY OF "TALKING" BOOKS | |
Ariffin et al. | Plan recognition scheme using multi-factors authentication for smart card online system | |
Dippel et al. | AUTHENTICATION OF COMPUTER COMMUNICATIONS |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 19960226 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): CH DE FR GB LI |
|
GRAG | Despatch of communication of intention to grant |
Free format text: ORIGINAL CODE: EPIDOS AGRA |
|
17Q | First examination report despatched |
Effective date: 19960912 |
|
GRAH | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOS IGRA |
|
GRAH | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOS IGRA |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): CH DE FR GB LI |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: FR Effective date: 19970716 |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: NV Representative=s name: CARL O. BARTH C/O IBM CORPORATION ZURICH INTELLECT Ref country code: CH Ref legal event code: EP |
|
REF | Corresponds to: |
Ref document number: 69312328 Country of ref document: DE Date of ref document: 19970821 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LI Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 19970930 Ref country code: CH Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 19970930 |
|
EN | Fr: translation not filed | ||
REG | Reference to a national code |
Ref country code: CH Ref legal event code: PL |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
26N | No opposition filed | ||
REG | Reference to a national code |
Ref country code: GB Ref legal event code: IF02 |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: 746 Effective date: 20080808 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20100923 Year of fee payment: 18 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: DE Payment date: 20100927 Year of fee payment: 18 |
|
GBPC | Gb: european patent ceased through non-payment of renewal fee |
Effective date: 20110920 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R119 Ref document number: 69312328 Country of ref document: DE Effective date: 20120403 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20120403 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: GB Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20110920 |